Driver 6: Technology – Sub-driver Questions (c. Security and Privacy) c.1. Responsibility NA. None of the statements apply (AP 6.1.4) B. Security and privacy issues are driven ‘bottom-up’ in the organisation (AP 6.2.5) D. Security is viewed as an IT issue, but has oversight from and regular reporting to, non-IT stakeholders (AP 6.3.7) L.
Security is viewed as a critical component of the organisation’s overall risk management via strong ‘tone at the top’
c.2. Scope NA. None of the statements apply (AP 6.1.5) B. Compliance with regulatory requirements drives security efforts; Focus on the importance of digital assets to organisation strategy is limited; Security issues are identified and addressed reactively (AP 6.2.5) D. Security architecture is in place that supports a defence strategy. This provides layers of deterrence that limits attackers’ ability to access critical digital assets; The security function recognises and regularly evaluates the ecosystem including reliance on third parties and partners (AP 6.3.7) L.
Security efforts follow an ‘active defence’ approach with proactive identification of issues driven from inside the organisation; Security and privacy strategies are driven by protection of the most critical digital assets and support of organisation growth drivers
c.3. Focus NA. None of the statements apply (AP 6.1.6) B. The security focus is on building and/or maintaining perimeter controls and legacy end-point controls (e.g. anti-virus) (AP 6.2.5) D. The company recognises and balances investment and operational effort between preventative controls and a strong monitoring and response capability (AP 6.3.7) L.
The focus is on operating a resilient security and privacy capability
Click here to see the Action Plans
Legend:
62
B
Basic
D
Developing
L
Leading
NA
Not Applicable
